openqodex 0.5.0 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.md +14 -10
  2. package/dist/bin.js +918 -505
  3. package/docs/agents.md +9 -7
  4. package/docs/cli.md +2 -2
  5. package/docs/config.md +2 -2
  6. package/docs/github-action.md +1 -1
  7. package/docs/internal-reviewer-drivers.md +53 -20
  8. package/docs/plumbing.md +1 -1
  9. package/docs/quickstart.md +3 -3
  10. package/docs/security.md +25 -5
  11. package/package.json +1 -1
  12. package/skills/openqodex/SKILL.md +13 -13
package/README.md CHANGED
@@ -6,7 +6,7 @@
6
6
  [![licence](https://img.shields.io/badge/licence-Apache--2.0-blue)](LICENSE)
7
7
  [![CI](https://github.com/openqodex/openqodex/actions/workflows/ci.yml/badge.svg)](https://github.com/openqodex/openqodex/actions/workflows/ci.yml)
8
8
 
9
- OpenQodex is open source code review that runs before you push, from your coding agent or your terminal. One command, `openqodex review`, works out your change: the commits not yet pushed plus everything uncommitted. It runs the scanners that fit the changed files and keeps only findings on the lines you changed. Then it starts its own reviewer, a separate Claude Code process that reads a frozen copy of the change and nothing else. The reviewer checks every scanner finding and reads every changed line. OpenQodex checks its answer with scripts and prints one report. It needs Claude Code installed and logged in, and no other key, account or server.
9
+ OpenQodex is open source code review that runs before you push, from your coding agent or your terminal. One command, `openqodex review`, works out your change: the commits not yet pushed plus everything uncommitted. It runs the scanners that fit the changed files and keeps only findings on the lines you changed. Then it starts its own reviewer, a separate Claude Code or Codex process that reads a frozen copy of the change. The reviewer checks every scanner finding and is given every changed line. OpenQodex checks its answer with scripts and prints one report. It needs Claude Code or Codex installed and logged in, and no other key, account or server.
10
10
 
11
11
  ## Install
12
12
 
@@ -41,8 +41,10 @@ Four commands: `init`, `review`, `update` and `trust`. The commands hooks and ag
41
41
 
42
42
  - `openqodex review` runs the whole review in one command: a frozen copy of the change, the scanners, the code graph, a reviewer process OpenQodex starts, script checks of its answer, and one report in the terminal and in `report.md`, `report.json` and `report.sarif`.
43
43
  - `openqodex review --all` reviews the whole repository. `openqodex review <branch>` and `openqodex review '#42'` review a branch or a pull request that is not your current work. OpenQodex fetches it, checks it out in a temporary folder and reviews what it added since it left its base.
44
- - The reviewer is Claude Code (`claude -p`), started with read, search and list tools only, inside the copy of the change, with none of your settings, hooks, plugins, memory or instruction files. Codex and Cursor cannot be held to that yet, so they are not used as reviewers: [docs/internal-reviewer-drivers.md](docs/internal-reviewer-drivers.md) says why.
45
- - A review is complete only when every stage ran, every scanner finding was raised or dropped with a reason, and every changed line was read. Anything else prints "Review incomplete" with what is missing, and exits 2.
44
+ - The reviewer is Claude Code (`claude -p`) or Codex (`codex exec`). `auto` picks the agent you run the command from, then Claude Code, then Codex; `--reviewer` or `reviewer:` in `~/.openqodex/config.yaml` picks one.
45
+ - Claude Code starts with read, search and list tools only, inside the copy of the change, with none of your settings, hooks, plugins, memory or instruction files. Its event stream shows every read, so the report lists the files it read.
46
+ - Codex starts in a read-only sandbox that confines reads to the copy of the change and the system folders, with no network for its commands and none of your config, plugins, hooks or the repository's instruction files. It still loads your global `~/.codex/AGENTS.md`, and its event stream does not show every command, so the report says its reads were not recorded. [docs/internal-reviewer-drivers.md](docs/internal-reviewer-drivers.md) gives the tests.
47
+ - A review is complete only when every stage ran, every scanner finding was raised or dropped with a reason, and every changed line was in front of the reviewer: in the brief, in a later message from OpenQodex, or, for Claude Code, in a file it read. Anything else prints "Review incomplete" with what is missing, and exits 2.
46
48
  - A change that only deletes code, such as a removed check, can still carry a finding: the lines next to a deletion count as changed.
47
49
  - Thirteen built-in scanners. Every downloaded scanner is pinned to one version. Each runs only when the change holds a file it reads.
48
50
  - Any scanner by its GitHub link, after you approve it with `openqodex trust`.
@@ -52,11 +54,12 @@ Four commands: `init`, `review`, `update` and `trust`. The commands hooks and ag
52
54
 
53
55
  ## What it does not do yet
54
56
 
55
- - The separate reviewer process needs Claude Code today. Without it, `review` prints "Full review unavailable", says what is missing, saves the unchecked scanner findings to a file it names, and names the command with which the agent you are in reviews the change itself (`review --agent`). That report says which agent reviewed.
56
- - No Codex or Cursor reviewer. Codex always loads your own `~/.codex/AGENTS.md` and does not show every command it runs in its event stream. `cursor-agent` has no way to limit its tools to reading or to skip your rules and settings.
57
- - A review takes one to three minutes and uses your own Claude Code plan.
58
- - No review finds everything. The promise is that every stage runs, every scanner finding is checked, every changed line is read, and anything skipped is named.
59
- - No review on your own API key without Claude Code.
57
+ - The separate reviewer process needs Claude Code or Codex. Without either, `review` prints "Full review unavailable", says what is missing, saves the unchecked scanner findings to a file it names, and names the command with which the agent you are in reviews the change itself (`review --agent`). That report says which agent reviewed.
58
+ - No Cursor reviewer. `cursor-agent` has no way to limit its tools to reading or to skip your rules and settings.
59
+ - Codex cannot be the reviewer when `openqodex review` runs inside Codex's own sandbox: a second Codex does not start there. `review` then prints "Full review unavailable" and the `review --agent` command.
60
+ - A review takes one to three minutes and uses your own Claude Code or Codex plan.
61
+ - No review finds everything. The promise is that every stage runs, every scanner finding is checked, every changed line is put in front of the reviewer, and anything skipped is named.
62
+ - No review on your own API key without Claude Code or Codex.
60
63
  - No tool server for agents (MCP).
61
64
  - No Homebrew formula, no install script and no Docker image. Install through npm.
62
65
  - No Windows support outside WSL.
@@ -120,7 +123,8 @@ npx openqodex trust
120
123
  - Scanner downloads on first use: GitHub release files checked against pinned sha256 sums, and pinned packages from PyPI, npm and RubyGems.
121
124
  - Semgrep rule packs (`p/default`, `p/security-audit`, `p/secrets`), fetched from the Semgrep registry on each run.
122
125
  - When the change holds a lockfile, osv-scanner sends dependency names and versions to osv.dev. It never sends code.
123
- - The reviewer: Claude Code sends the review brief and the files it reads from the copy of the change to the model your Claude Code login uses. It has no web tool unless you set `reviewer_web: on` in `~/.openqodex/config.yaml`.
126
+ - The reviewer: Claude Code sends the review brief and the files it reads from the copy of the change to the model your Claude Code login uses. It can also open web pages (WebSearch and WebFetch); `reviewer_web: off` in `~/.openqodex/config.yaml` removes the web tools.
127
+ - The reviewer, when it is Codex: Codex sends the conversation, which holds the brief, your global `~/.codex/AGENTS.md` and the output of the commands it runs in the copy of the change, to the model your Codex login uses. It can also use Codex's cached web search unless `reviewer_web: off` is set; its commands get no network either way.
124
128
 
125
129
  - `openqodex trust` reads the custom scanner's release from the GitHub API and downloads it.
126
130
  - `openqodex review <branch>` or `review '#<number>'` fetches that branch or pull request from your remote with git, and asks `gh` for the pull request's base when `gh` is installed.
@@ -128,7 +132,7 @@ npx openqodex trust
128
132
 
129
133
  `--offline` skips osv-scanner and semgrep and turns scanner downloads, the version check, and the fetch and `gh` call of a branch or pull request review off.
130
134
 
131
- The built-in scanners send no code anywhere. The reviewer's model sees the brief and what the reviewer reads, as with any Claude Code session. A custom scanner you approved does whatever its own command does. [docs/security.md](docs/security.md) gives the full list.
135
+ The built-in scanners send no code anywhere. The reviewer's model sees the brief and what the reviewer reads, as with any Claude Code or Codex session. A custom scanner you approved does whatever its own command does. [docs/security.md](docs/security.md) gives the full list.
132
136
 
133
137
  ## Updates
134
138